Detections API¶

Query detections from endpoints, servers, and third-party integrations.

See the guide for a narrative walkthrough of this API.

Base URL¶

https://api-{dataRegion}.central.sophos.com/detections/v1 — Regional service in the production environment.

Authentication¶

Every request carries an Authorization: Bearer header with an access token obtained through the client-credentials flow — see Get started.

Required permissions¶

This API's operations require one or more of the following, depending on the operation — see each operation's own page for the exact requirement:

• detections.queries.detections:create
• detections.queries.detections:read

Operations¶

DetectionGroup¶

Detections¶

Download¶

• OpenAPI spec